Skip to content

Simplified integration with namespace local JupyterHub Helm charts#612

Merged
consideRatio merged 1 commit into
dask:mainfrom
consideRatio:pr/simplied-integration-with-namespace-local-jh
Oct 13, 2022
Merged

Simplified integration with namespace local JupyterHub Helm charts#612
consideRatio merged 1 commit into
dask:mainfrom
consideRatio:pr/simplied-integration-with-namespace-local-jh

Conversation

@consideRatio

@consideRatio consideRatio commented Oct 7, 2022 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

Closes #473. The idea is to enable users installing both the dask-gateway chart and jupyterhub chart to not provide any api-token credential for dask-gateway/juyterhub to trust each other, but instead rely on a generated api-token persisted in a k8s Secret.

The implementation plan in #473 was the following:

Implementation idea

  1. Allow a k8s Secret name and key be configurable to mount the JupyterHub API token from a custom k8s Secret with a given key.
  2. Make the creation of the dask-gateway managed k8s Secret be conditional of not providing a custom k8s Secret name / key.
  3. Update the values schema with these settings

This PR follows that plan quite well, but provides a default for the k8s Secret name and Key config and relies on them by default unless the previously required apiToken is specified. This PR also updates the documentation under the topic of installing the dask-gateway helm chart and autenticating against a JupyterHub Helm chart installation.

Added chart config in values.yaml

gateway:
  auth:
    jupyterhub:
      # The JupyterHub Helm chart will automatically generate a token for a
      # registered service. If you don't specify an apiToken explicitly as
      # required in dask-gateway version <=2022.6.1, the dask-gateway Helm chart
      # will try to look for a token from a k8s Secret created by the JupyterHub
      # Helm chart in the same namespace. A failure to find this k8s Secret and
      # key will cause a MountFailure for when the api-dask-gateway pod is
      # starting.
      apiTokenFromSecretName: hub
      apiTokenFromSecretKey: hub.services.dask-gateway.apiToken

The schema file is also updated to reflect this new configuration.

Successfully tested

I've tested this on the hub.jupytearth.org deployment of a dask-gateway deployed next to a jupyterhub.

How dask/helm-chart's daskhub would adjust with this

Steps relating to generating and configuring an api token could be simplied. This would be an example of the configuration to have, without secret credentials involved.

jupyterhub:
  hub:
    services:
      dask-gateway:
        display: false

dask-gateway:
  gateway:
    auth:
      type: jupyterhub

@consideRatio consideRatio added enhancement New feature or request new codebase:helm-chart and removed enhancement New feature or request labels Oct 7, 2022
@consideRatio
consideRatio force-pushed the pr/simplied-integration-with-namespace-local-jh branch from ef23bda to 100259f Compare October 7, 2022 17:08
consideRatio added a commit to consideRatio/pilot-hubs that referenced this pull request Oct 7, 2022
@consideRatio
Rely on dask-gateway to mount api-token from jupyterhub chart
2a0ff8a 
Relies on dask/dask-gateway#612 released in some
version after 2022.6.1 so we don't have to set this explicitly.
This was referenced Oct 7, 2022
Closed
Closed
Merged
TomAugspurger
TomAugspurger approved these changes Oct 13, 2022
View reviewed changes

@TomAugspurger TomAugspurger left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Very cool @consideRatio!

One quick question: do you worry at all about upgrades to existing deployments? I suspect things will be just fine, since providing your own tokens continues to be an option.

@consideRatio

consideRatio commented Oct 13, 2022 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

One quick question: do you worry at all about upgrades to existing deployments? I suspect things will be just fine, since providing your own tokens continues to be an option.

Exactly, previously everyone has been forced to provide a token - so they should all be fine as this will only impact people not providing a token.

Thank you for looking at this PR @TomAugspurger!!!

@TomAugspurger

TomAugspurger commented Oct 13, 2022

Copy link
Copy Markdown
Member

Great, thanks. Feel free to merge whenever you're ready!

@consideRatio
consideRatio merged commit 3914e0a into dask:main Oct 13, 2022
@consideRatio

consideRatio commented Oct 13, 2022

Copy link
Copy Markdown
Collaborator Author

Thanks! Going for it!

consideRatio added a commit to consideRatio/pilot-hubs that referenced this pull request Oct 13, 2022
@consideRatio
Use dask-gateway 2022.10.0 and rely on mounted api-token from jupyter…
50dc253 
…hub chart

Relies on dask/dask-gateway#612 released in
2022.10.0 so we don't have to set this explicitly.
@consideRatio consideRatio mentioned this pull request Oct 13, 2022
Merged
consideRatio added a commit to consideRatio/pilot-hubs that referenced this pull request Oct 13, 2022
@consideRatio
Use dask-gateway 2022.10.0 and rely on mounted api-token from jupyter…
a3ab356 
…hub chart

Relies on dask/dask-gateway#612 released in
2022.10.0 so we don't have to set this explicitly.
@consideRatio consideRatio mentioned this pull request Oct 13, 2022
Merged
yuvipanda pushed a commit to consideRatio/pilot-hubs that referenced this pull request Oct 14, 2022
@consideRatio @yuvipanda
Use dask-gateway 2022.10.0 and rely on mounted api-token from jupyter…
acbb8d0 
…hub chart

Relies on dask/dask-gateway#612 released in
2022.10.0 so we don't have to set this explicitly.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jacobtomlinson jacobtomlinson Awaiting requested review from jacobtomlinson
@martindurant martindurant Awaiting requested review from martindurant
1 more reviewer
@TomAugspurger TomAugspurger TomAugspurger approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

codebase:helm-chart new

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Helm chart: allow JUPYTERHUB_API_KEY to be mounted from specified k8s secret and key

2 participants

@consideRatio @TomAugspurger